3 ms·

Anyone who can open issues in a repo I think

• mattbee 5y ago
  I am confused by this right now. I built a self-hosted gitlab install years ago for my own use, turned off sign-up, no public project listings - and still it was compromised. The HackerOne PoC URL throws a sign-in redirect for me, so I'm still trying to work it out.
  • cjbprime 5y ago
    It was originally incorrectly thought to require authentication, but actually doesn't.
  • ceochronos 5y ago
    Same thing happened with my self-hosted gitlab. Besides I got a new user (gitlab) with admin privileges and somehow installed a miner script running under git user (system).